Monitoring wireless access point events

ABSTRACT

A wireless access point system includes a processor configured to tap event data and process the event data using a plurality of event filters. Each event filter of the plurality of event filters applies event criteria to detect one or more types of events. The wireless access point system includes a memory configured to store the tapped event data. The wireless access point system includes a communication interface configured to report a report of a detected event type. At least a portion of the report is correlated to analyze a performance of a wireless network.

BACKGROUND OF THE INVENTION

A wireless access point allows clients to wirelessly access a network.However, when a client encounters a network error or an issue whileutilizing the wireless access point, often the error/issue must bediagnosed and fixed manually by a user or a network administrator. Forexample, in a commercial setting, a network administrator is tasked withmanually diagnosing, reporting, and resolving, if possible, any problemswith network connectivity, including the wireless access point. This canbe often tedious, inefficient, and expensive to manually resolve usingprofessional human resources. Additionally, it would be beneficial toprevent, handle, and resolve network issues as soon as possible toimprove user experience. Therefore, there exists a need to moreefficiently analyze the performance and issues of wireless clientsconnected to a wireless network.

BRIEF DESCRIPTION OF THE DRAWINGS

Various embodiments of the invention are disclosed in the followingdetailed description and the accompanying drawings.

FIG. 1 is a block diagram illustrating an embodiment of a system foranalyzing event data of a wireless access point.

FIG. 2 is a flow chart illustrating an embodiment of a process forprocessing events to determine one or more types of events.

FIG. 3 is a flow chart illustrating an embodiment of a process foranalyzing one or more reports of types of events.

FIG. 4 is a flow chart illustrating an embodiment of a process forprocessing events to identify a Dynamic Host Configuration Protocol(i.e., DHCP) error.

FIG. 5 is a flowchart illustrating an embodiment of a process foranalyzing DHCP issue event type reports.

FIG. 6 is a flowchart illustrating an embodiment of a process forprocessing events to identify a client roaming error.

FIG. 7 is a flow chart illustrating an embodiment of a process foranalyzing reports of a poor wireless connection.

DETAILED DESCRIPTION

The invention can be implemented in numerous ways, including as aprocess; an apparatus; a system; a composition of matter; a computerprogram product embodied on a computer readable storage medium; and/or aprocessor, such as a processor configured to execute instructions storedon and/or provided by a memory coupled to the processor. In thisspecification, these implementations, or any other form that theinvention may take, may be referred to as techniques. In general, theorder of the steps of disclosed processes may be altered within thescope of the invention. Unless stated otherwise, a component such as aprocessor or a memory described as being configured to perform a taskmay be implemented as a general component that is temporarily configuredto perform the task at a given time or a specific component that ismanufactured to perform the task. As used herein, the term ‘processor’refers to one or more devices, circuits, and/or processing coresconfigured to process data, such as computer program instructions.

A detailed description of one or more embodiments of the invention isprovided below along with accompanying figures that illustrate theprinciples of the invention. The invention is described in connectionwith such embodiments, but the invention is not limited to anyembodiment. The scope of the invention is limited only by the claims andthe invention encompasses numerous alternatives, modifications andequivalents. Numerous specific details are set forth in the followingdescription in order to provide a thorough understanding of theinvention. These details are provided for the purpose of example and theinvention may be practiced according to the claims without some or allof these specific details. For the purpose of clarity, technicalmaterial that is known in the technical fields related to the inventionhas not been described in detail so that the invention is notunnecessarily obscured.

Facilitating analysis of wireless network performance (e.g., wirelessnetwork performance of a mobile user) and mitigating the root cause isdisclosed. In some embodiments, event and performance data is tapped ata wireless access point. For example, the network packets of thewireless access point are intercepted within the wireless access pointfor analysis to detect any event types of interest. The tapped eventdata is stored temporarily for potential future analysis. For example inone embodiment, the event data is stored in a ring buffer for analysis.In some embodiments, the event data is processed using a plurality ofevent filters, each of which applies event criteria to detect one ormore types of events. For example, each filter has been configured toanalyze the stored event data to identify an event type of interest, andwhen the event type of interest has been detected, additional processingmay be performed (e.g., report the event type of interest, resolveerrors associated with event type, etc.). The detected event types arereported. For example, a report on a detected event type is sent to aremote server via a network for further analysis. In some embodiments,detected event types are correlated across different wireless accesspoints at a server so that performance of the wireless network can beanalyzed, improved, and/or reported (e.g., report to networkadministrator).

FIG. 1 is a block diagram illustrating an embodiment of a system foranalyzing event data of a wireless access point and/or wireless client.A wireless access point (i.e., AP) allows one or more client devices towirelessly connect to a network. For example, client 114 connects towireless access point 102 via a wireless connection and accesses theInternet via AP 102. Although only one client is shown as connected toAP 102 in the example of FIG. 1, a plurality of clients may be connectedto AP 102 simultaneously and the clients may communicate with oneanother via AP 102. Examples of client 114 include a laptop computer, adesktop computer, a smartphone, a tablet computer, an Internet of Thingsdevice, a wearable computer, a wireless repeater, a wireless router, orany other wireless computer or device. In some embodiments, AP 102includes and/or is included in a wired router. For example, AP 102includes a wired Ethernet router. AP 102 includes components wirelessradio 104, Ethernet 106, tap 108, storage 110, and event type filters112. The components shown in FIG. 1 may be hardware and/or softwarecomponents. For example, wireless radio component 104 may include awireless radio driver, integrated circuit chip, and/or firmware. Inanother example, Ethernet component 106 includes an Ethernet controller,driver, chip, and/or firmware. In some embodiments, wireless radio 104receives communication to/from client 114 wirelessly and thecommunication is routed from/to Ethernet 106 for communication via awired connection to network 116. Examples of wireless communicationbetween wireless radio 104 and client 114 include Wi-Fi, IEEE 802.11x,Bluetooth, and/or other wireless standards and protocols.

Tap component 108 taps into wireless radio 104 and Ethernet 106 toobtain event data of interest. For example, packets such as controlpackets and data communication packets received or sent by wirelessradio 104 and/or Ethernet 106 or communicated between wireless radio 104and Ethernet 106 are obtained by tap 108. Tap component 108 may includeany number of component taps. For example as shown in FIG. 1, tap 108includes an analytic tap and a performance tap. For example, theperformance tap examines the actual contents of network packets toobserve headers and statistics on packet flow to identify data packetsfor storage in storage 110 and the analytic tap observes networkstatistics (e.g., client received signal strength indicator (RSSI),dropped packets, etc.) to identify analytic performance data foranalysis and storage in storage 110. In some embodiments, the softwareand/or firmware drivers of wireless radio 104 and/or Ethernet 106 havebeen configured to allow tap 108 to receive (e.g., intercept) event dataof interest. Tap 108 may be a software module of a software kernel of AP102. In some embodiments, the event data obtained by tap 108 have beenselectively obtained based on one or more preconfigured criteria. Insome embodiments, the events/data obtained by tap 108 include everypacket of wireless radio 104. In some embodiments, the types of dataobtained by tap 108 include specific types of data specified by one ormore event type filters of component 112. The event data obtained by tap108 are stored in storage 110. Examples of storage include a memory, ahard drive, a flash drive, a buffer and any other type of storage. Insome embodiments, event data entries stored by tap 108 in storage 110are automatically deleted based on a policy. For example, an oldestentry is selectively deleted when storage 110 is full to create storagespace for a new data entry. In another example, an entry is deletedafter a predetermined amount of time has passed since a timestamp of theentry. In another example, all events/data associated with a particularclient are deleted when the particular client is disconnected from AP102. In some embodiments, event data obtained by tap 108 is stored in aring buffer of storage 110. For example, the ring buffer is limited intotal storage size and/or total number of entries and when the ringbuffer is full, entries are deleted in a first-in-first-out order tocreate storage space for a new entry to be added.

Event type filters component 112 includes one or more preconfiguredfilters. For example, a user/administrator is able to add/remove/modifyone or more desired filters to event type filters 112. Each filter maydefine one or more event criteria to classify event data to detect oneof a plurality of types of events. For example, event data (e.g.,network packets) stored in storage 110 is analyzed using a filter todetermine whether a type of event to be detected using the filter hasbeen detected. A filter may perform actions such as send/receive networkdata based on the detection of the type of event. For example, eventtype filters are utilized to detect potential and/or existing networkproblems and automatically mitigate and/or resolve the network problems.In some embodiments, an event type filter sends a report regarding oneor more detected event types to analysis server 118 via network 116 foranalysis. For example, detected types of events at various APs arecorrelated by analysis server 118. The report may include data packets,indication of type of event detected, a status of an AP, and/or anyother information associated with the type of event. In someembodiments, the report is sent by the event type filter to another AP.For example, rather than correlating information across various APs at aremote analysis server, an AP receives one or more reports from otherAPs to correlate data and determine a correlation result. In someembodiments, the data associated with a detected event is stored instorage 110 by an event type filter. In some embodiments, storage 110tracks a status and/or other information associated with each clientconnected to AP 102.

Analysis server 118 may include one or more devices. For example,analysis server 118 represents a cloud/cluster of servers and/ornetworked storage. Analysis server 118 includes event type correlationand analysis component 120. Component 120 receives data from event typefilters of different APs and correlates the data to determine a result.In some embodiments, component 120 receives data from location service120 for correlation and analysis with one or more event reports. In someembodiments, location service 120 tracks determined physical locationsof one or more clients that are connected any of one or more APs,including AP 120. For example, based on signal strength, reported GPSdata and/or other detected factors, current physical locations ofclients connected to APs of a physical site are tracked by locationservice 120. In some embodiments, component 120 performs correlation fora single type of event and receives reports from the same event typefilter of various different APs. There may exist a plurality ofdifferent event type correlation and analysis engines within server 118.For example, each different event type correlation and analysis engineof server 118 corresponds to a different type of event type filter(e.g., filter of 112). In some embodiments, event type correlation andanalysis component 120 performs correlation and analysis for a pluralityof different types of events. In some embodiments, component 120performs correlation and analysis using external event types (e.g.,external events/data gathered/received from sources external a networkof clients and APs) in addition to internal event types detected by oneor more APs. For example, a release of a new operating system isdetected from an external source and correlated with event typesreported by APs. In some embodiments, performing the correlation andanalysis includes determining similarities and patterns of detectedtypes of events. For example, a network error is detected by variousevent type filters of APs that are correlated to identify a common causeof the network error. In some embodiments, performing the correlationand analysis includes sending a command and/or instruction to one ormore APs. For example, an instruction/command on how to resolve and/ormitigate a detected problem is sent to APs identified to be affected. Insome embodiments, an event type filter sends a report to server 118 foranalysis to offload processing in an effort to save the computingresources required of an AP.

Event type correlation and analysis database 122 stores correlation andanalysis results of one or more event type correlation and analysiscomponents (e.g., component 120). In some embodiments, database 122stores data/reports received from one or more APs for analysis by one ormore event type correlation and analysis components (e.g., component120). In some embodiments, database 122 tracks the status of one or moreAPs and/or clients of one or more APs. For example, database 122 trackseach client that has been affected by a particular network error.Mitigation module 120 receives input from one or more event typecorrelation and analysis engines (e.g., engine 120) and/or database 122to determine one or more instructions to be provided to a AP, a client,an end user and/or a network administrator to mitigate, resolve and/orprevent detected network issues (e.g., network error). In an alternativeembodiment, mitigation module 120 is external to server 118. Dashboard124 provides one or more interfaces to allow an end user of a clientand/or administrator to view correlation/analysis results and/or astatus/performance of one or more APs. For example, correlation/analysisresults of an issue affecting clients of APs managed by a networkadministrator are able to be viewed by the network administrator via awebpage interface of dashboard 124 accessed via network 116. In someembodiments, an administrator and/or an end user is provided anidentification of an issue (e.g., network error) affecting one or moreAPs and/or clients and is provided an interface/instructions to manageand/or mitigate/resolve the issue.

Examples of network 116 include one or more of the following: a director indirect physical communication connection, a mobile communicationnetwork, a wireless network, Internet, intranet, Local Area Network,Wide Area Network, Storage Area Network, and any other form ofconnecting two or more systems, components, or storage devices together.Other communication paths may exist and the example of FIG. 1 has beensimplified to illustrate the example clearly. The connections betweenthe components shown in FIG. 1 may be a wired connection, a wirelessconnection, and/or software data communication paths. In someembodiments, client 114 connects to AP 102 to access the Internet ofnetwork 116. Although single instances of the components shown in FIG. 1have been shown to simplify the diagram, additional instances of any ofthe components shown in FIG. 1 may exist. For example, any number of APsmay exist and provide data/reports to server 118. Any number of analysisservers may be connected to network 116. Many clients may be connectedto AP 102. Any number of event type filters and event type correlatorsmay exist. Components not shown in FIG. 1 may also exist.

FIG. 2 is a flow chart illustrating an embodiment of a process forprocessing events to determine one or more types of events. The processof FIG. 2 may be implemented on wireless access point 102 of FIG. 1. Invarious embodiments, at least a portion of the process of FIG. 2 isrepeated periodically and/or dynamically.

At 202, event data is received. In some embodiments, receiving the eventdata includes tapping into occurrences of events at an AP. In someembodiments, receiving the events includes intercepting event data at anAP. For example, the received event data is a copy of packets handled bythe AP. The event data may include control packets, data packets,message packets, or any other forms of communication network packets. Insome embodiments, one or more drivers and/or firmware of an AP providesaccess to the received event data. For example, a wireless radio driverand/or Ethernet driver has been configured to provide the received eventdata. In some embodiments, the event data includes one or morecommunications to and/or from a wireless radio component and/or anEthernet component of an AP. In some embodiments, the event data isreceived at a software and/or hardware component of the AP configured tohandle the received events.

In some embodiments, receiving the event data includes allowing networkpackets of interest to be processed and routed as normal by the AP whilecopying the network packets to storage 110 to be received at 202. Insome embodiments, the received event data is received at tap 108 ofFIG. 1. For example, tap 108 implemented in a kernel module of AP 102monitors network packets and the status of AP 102 and obtains theinformation of interest. In some embodiments, only specific event datathat fits a criteria is received. For example, packets are filteredusing one or more specified filters to only receive packets of interest.The criteria may be specified by a user/administrator. In someembodiments, the criteria is associated with one or more event typefilters (e.g., event type filters 112 of FIG. 1). For example, thecriteria utilized to filter the received event data corresponds to eventdata to be analyzed by one or more event type filters to detect one ormore types of events. In some embodiments, the received events arefiltered after being received and specific event data that does fit acriteria is dropped.

At 204, the received event data is stored. For example, the packetsand/or status/information of interest of an AP is stored in storage 110of FIG. 1. In some embodiments, storing the event data includesfiltering the received data to only store event data that meets thecriteria. For example, the criteria utilized to filter the receivedevents corresponds to event data to be analyzed by one or more eventtype filters to detect one or more types of events. In some embodiments,storing the event data includes deleting an event data entry fromstorage 110. For example, of the event data stored in afirst-in-first-out data structure, the oldest entry in the datastructure is removed if the data structure is full. In some embodiments,a stored event data entry expires after a predetermined threshold amountof time after being stored and is automatically deleted when thethreshold amount of time has been reached. In some embodiments, receivedevent data is categorized and stored in a specific datalocation/structure at least in part based on the categorization. Forexample, different data structures store different categories of eventdata.

At 206, the stored event data is processed using one or more event typefilters to detect one or more types of events. In some embodiments, theevent type filters include one or more preconfigured filters. Forexample, a user/administrator is able to add/remove/modify one or moredesired filters to be applied by an AP. Each filter may define one ormore criteria to identify a status and/or type of event of interest. Forexample, stored event data (e.g., network packets) is analyzed using anevent type filter to determine whether a type of event to be detectedusing the filter has been detected. In one example, an event type filteranalyzes stored event data of interest (e.g., searches for networkpackets containing specific content) to identify an event data pattern(e.g., repeated event data, a specific series of event data, etc.) thatidentifies a type of event. In some embodiments, a filter may performactions such as send/receive data (e.g., requests for information) inorder to detect a type of event. For example, once a certain event data(e.g., certain error message packet) has been detected by a filter, thefilter sends an interrogation communication (e.g., test packet) to testa hypothesis of a cause of the certain event data and determines whethera certain type of event has occurred based on the response of theinterrogation communication. In another example, once a type of event(e.g., network/communication error) has been detected using a filter,the filter initiates commands and/or communication to handle (e.g.,mitigate and/or resolve) the type of event. In some embodiments,processing the event data includes periodically executing each eventtype filter to perform processing and event type detection of the eventtype filter. In some embodiments, the event type filter selects one ormore event data entries of interest that meet a criteria of the eventtype filter to be included in a report to be sent for further analysis.For example, an event type filter is configured to send new controlpackets (e.g., packets specifying communication status, configuration,setup, error, etc.) in a report for further analysis.

At 208, any detected event type is reported. In some embodiments, oncean event type filter has detected a type of event, a report of thedetected type of event is sent. The report may be sent to an analysisserver (e.g., server 118) and/or another AP for further analysis and/orarchival/reporting. For example, a centralized server with morecomputing resources than an AP may perform the analysis. In anotherexample, an AP receives reports from other related APs and performscorrelation across different reports to discover correlation results. Insome embodiments, reporting the detected event type includes sending acopy of one or more stored event data (e.g., packets) corresponding tothe detected type of event. For example, the event data stored instorage 110 of FIG. 1 that indicates the type of event is included in areport sent for further analysis. The report may include one or more ofthe following: information about the type of event identified,identification of one or more clients associated with the type of event,a status of one or more clients associated with the type of event,identification of an AP associated with the type of event, or a statusof an AP and other information associated with the identified type ofevent. In some embodiments, by utilizing the reported information, therecipient may correlate the reported information across various otherreports from other APs to determine a correlation result. For example, anetwork problem affecting one AP may be due to an error specific to theparticular AP while the same network problem encountered by multipledifferent APs may be due to an error of a remote network service. Insome embodiments, the report includes encrypted and/or compressed data.For example, a compressed version of event data is included in thereport to reduce bandwidth required to transmit the report.

In some embodiments, reporting the detected event type includes trackinga status of the detected type of event once it has been detected. Forexample, once a network problem event type has been detected andreported, a status of the problem is tracked and reported until theproblem has been resolved and/or is no longer applicable. In oneexample, a list of clients affected by the detected event type ismaintained and the status of the event type for each client isperiodically determined (e.g., send a query communication, analyze newlytapped event data, etc.) and any change in the status of the event typefor each client is reported to an analysis server.

At 210, an instruction regarding one or more of the detected event typesis received. In some embodiments, the instruction is received from arecipient that received the report sent in 208. For example, an analysisserver provided the instruction. In another example, a remote APprovided the instruction. In some embodiments, the instruction is basedat least in part on analysis and/or correlation results associated withthe report sent in 208. For example, an instruction on how to handle thedetected event type is received in 210. In some embodiments, theinstruction modifies a status, a configuration, data, a filter, asoftware component, a driver, and/or other component or operation of anAP. In some embodiments, the instruction indicates a data to be sentfrom an AP. In some embodiments, the instruction includes a data (e.g.,packet) to be processed (e.g., processed as a received packet) by theAP. In some embodiments, the instruction identifies that status updatesregarding a specific detected event type should not be provided. Forexample, a recipient has received the report on the detected event typeand does not desire additional information about the detected eventtype. In some embodiments, the instruction identifies one or more clientinstructions to be provided to the client for implementation by theclient. In some embodiments, the instruction is associated withmitigation, preventing, and/or resolving an error detected as thedetected event type. In some embodiments, step 210 is optional. Forexample, for a particular detected event type, an instruction is notreceived.

At 212 the instruction is implemented. In some embodiments, implementingthe instruction includes executing processing identified by theinstruction. In some embodiments, implementing the instruction includesimplementing changes indicated by the instruction. For example, aconfiguration of an AP is modified as specified by the instruction. Insome embodiments, implementing the instruction includes processing oneor more packets included in the instruction as a packet received from asource different than the sender of the instruction. In someembodiments, implementing the instruction by an AP includes sending oneor more packets instructed in the instruction as a packet originated bya client of the AP (e.g., spoofed packet).

FIG. 3 is a flow chart illustrating an embodiment of a process foranalyzing one or more reports of types of events. The process of FIG. 3may be implemented on analysis server 118 of FIG. 1.

At 302, one or more reports indicating one or more detected types ofevents are received. In some embodiments, one or more reports sent in208 are received. In some embodiments, the report includes one or moreevent data (e.g., packets) to be analyzed. In some embodiments, thereports are received from a plurality of different APs and the reportsfrom APs that are associated (e.g., APs of the same physical site) aregrouped together. In some embodiments, reports for the same type ofevent are grouped together. The report may include one or more of thefollowing: information about the type of event identified,identification of one or more clients associated with the type of event,status of one or more clients associated with the type of event,locations of one or more clients associated with the type of event,identification of an AP associated with the type of event, status of anAP, and other information associated with the identified type of event.

At 304, one or more reports are sorted and analyzed/correlated todetermine an analysis/correlation result. By processing analysis and/orcorrelation at a remote server, computationally expensive analysis tasksmay be offloaded from an AP and trends across different APs may becorrelated to better determine a cause and/or resolution of a type ofevent. In some embodiments, event data and/or other data included inreports may be extracted from the report and separatelycorrelated/analyzed.

A separate software component may analyze and correlate reports for eachdifferent type of event. For example, a different analysis/correlationengine performs correlation for each different type of event andreceives reports from the same event type filter of various differentAPs. In some embodiments, the analysis/correlation engines may be atleast in part configured and/or specified by a user. For example, a usermay program/specify a desired analysis/correlation engine using anapplication programming interface (i.e., API) of an analysis server. Insome embodiments, a single engine performs correlation and analysis fora plurality of different types of events. In some embodiments, one ormore engines perform correlation and analysis using external event types(e.g., external events/data gathered/received from sources external toclients and APs) in addition to internal event types detected by one ormore APs. For example, a release of a new operating system is receivedfrom an external source and correlated with event types reported by APs.In some embodiments, performing the correlation and analysis includesanalyzing event data to identify an action to be performed based onanalysis results. For example, event data is analyzed to identify a userindication, a warning, a message, a status, and/or other information tobe provided. In another example, event data is analyzed to identify anaction to be performed to mitigate, prevent, and/or resolve a problem(e.g., network error, AP component error, etc.) discovered using theanalysis. In some embodiments, performing the correlation and analysisincludes determining patterns, trends, and/or correlating detected typesof events across different APs. For example, it is determined whether asame type of event associated with the same network component/servicehas been detected across a plurality of APs. In some embodiments, thenumber of clients and/or APs affected by a specific type of event maycorrespond to a different cause and/or resolution for the type of event.For example, an error event type detected at one AP may be due to the APwhile an error event type detected across different APs may be due to alarger network failure. In some embodiments, the analysis/correlationresult is stored in storage (e.g., stored in database 124 of FIG. 1).

At 306, instructions associated with the analysis/correlation of 304 aresent. In some embodiments, step 306 is optional. In some embodiments,the sent instruction is received at 210 of FIG. 2. In some embodiments,the instruction is based at least in part on analysis and/or correlationresults performed in 304. For example, an instruction on how to handle adetected event type is provided. In some embodiments, the instruction isto modify a status, a configuration, data, a filter, a softwarecomponent, a driver, and/or other component or operation of an AP. Insome embodiments, the instruction indicates a data to be sent by an AP(e.g., sent by the AP originated by a client of the AP). In someembodiments, the instruction includes data (e.g., packet) to beprocessed (e.g., processed as a received packet) by an AP. In someembodiments, the instruction indicates a data to be sent to a client ofan AP. In some embodiments, the instruction identifies that statusupdates regarding a specific detected event type are not to be provided.In some embodiments, the sent instruction is to be provided to a clientto allow the client to implement the instruction to mitigate, preventand/or resolve an error. In some embodiments, the instruction isassociated with mitigating, preventing, and/or resolving an error (e.g.,network error) detected as the detected event type.

At 308, the analysis/correlation result is provided. For example, a userand/or network administrator is provided an interface to viewcorrelation/analysis results and/or a status/performance of one or moreAPs. In some embodiments, correlation/analysis results of an event typeaffecting clients of APs managed by a network administrator are able tobe viewed by the network administrator via a webpage interface. In someembodiments, for a detected type of event (e.g., each network error),the identification of affected clients/APs, a number of the affectedclients/APs, a status of the affected clients/APs, a length of time theaffected clients/APs have been affected, possible resolutions for thedetected type of event, instructions attempted to resolve the detectedtype of event, a performance of the affected clients/APs, and/or anyother related data/information is provided. In some embodiments,providing the analysis/correlation result includes providing anotification message of the analysis/correlation.

FIG. 4 is a flow chart illustrating an embodiment of a process forprocessing events to identify a Dynamic Host Configuration Protocol(i.e., DHCP) error. The process of FIG. 4 may be implemented on wirelessaccess point 102 of FIG. 1. In some embodiments, the process of FIG. 4is a specific example of the process of FIG. 2. In some cases, a clientof an AP is unable to obtain an IP address from a DHCP service (e.g., aDHCP server or a pool of DHCP servers). In the event a client is unableto obtain an IP address to access a network, it is desirable to resolvethe error as soon as possible to enable the client to access the networkas soon as possible. In some embodiments, the inability of a client toobtain an IP address is automatically detected by an event type filterthat monitors for control packets that indicate the DHCP error eventtype. There may be various causes for the DHCP error, and in someembodiments, the cause is attempted to be discovered. If possible, theDHCP error may be automatically resolved.

At 402, network communication packets associated with a DHCP service arereceived. In some embodiments, receiving the packets includes tappinginto wireless radio drivers of an AP to obtain control packets (e.g.,DHCP discover, offer, request, acknowledgement, information, release,renewal, etc. packets) to and/or from a DHCP service/server. Forexample, when a new client requests an IP address lease by sending aDHCP discover control packet, DHCP offer control packets are received bya client via an AP from a DHCP service/server that makes an offer of anIP address lease, and the client responds via the AP to the offer bysending a DHCP request control packet that indicates the request for theoffered IP address lease. This request may be acknowledged by the DHCPserver using a DHCP acknowledgement packet. By obtaining these controlpackets that reveal the status DHCP service, the control packets may bestored and analyzed to detect any DHCP service problems. In someembodiments, receiving the packets includes intercepting the packets.The network communication packets may include control packets, datapackets, message packets, or any other forms of communication packets.In some embodiments, receiving the packets includes specificallyselecting network communication packets that are associated with a DHCPservice. In some embodiments, the network communication packetsassociated with a DHCP service are included in a larger group ofreceived network communication packets. In some embodiments, the networkcommunication packets associated with the DHCP service are stored. Forexample, the packets are stored in storage 110 of FIG. 1.

At 404, the received packets are analyzed to identify any DHCP issues.In some embodiments, an event type filter (e.g., one filter of filters112 of FIG. 1) that is configured to identify DHCP issues is executed.In some embodiments, analyzing the received packets includes analyzing ahistory of DHCP control packets that have been stored for analysis. Insome embodiments, the DHCP issues to be detected include discovering afailure to obtain and/or renew an IP address lease. For example,specific packets identifying failures and/or a lack of an expectedresponse packet are detected. In some embodiments, when a packet from aDHCP server indicates that an IP address pool has been exhausted, an IPaddress pool exhaustion failure is identified. In some embodiments, whena packet from a DHCP server indicates a service error, a DHCPservice/server error is identified. In some embodiments, when a packetfrom a DHCP server indicates an error during a DHCP session to obtain anIP address lease, a DHCP session error is identified. In someembodiments, when a DHCP service is unresponsive, an unresponsive DHCPservice is identified.

In some embodiments, a hypothesis of a type and/or cause of a DHCP issueis identified by analyzing the received DHCP control packets. In someembodiments, the hypothesis is tested by an event type filter to confirmor reject the hypothesis. In some embodiments, one or more packets(e.g., ping, ARP protocol packet, etc.) probing the state of the DHCPservice/server and/or an IP address pool is sent and the response and/ora lack of a response is analyzed to confirm, reject, or modify thehypothesis. For example, because a DHCP service has not responded to aDHCP discover control packet, a preliminary hypothesis is made that theDHCP service is offline and this hypothesis is tested by pinging theDHCP service/server with a ping packet. In the event the DHCPservice/server responds to the ping packet, the hypothesis is rejectedand another hypothesis may be determined. In some embodiments, a requestpacket is sent to discover the type, model, provider, manufacturer,and/or version of the DHCP service/server. For example, a certain DHCPservice/server version may be affected by a known bug, and a detectedDHCP issue may be attributable to the bug if the DHCP service/server isof the certain version.

At 406, any detected DHCP issues are reported. The report may be sent toan analysis server (e.g., server 118) and/or another AP for furtheranalysis and/or archival/reporting. For example, a centralized serverwith more computing resources than an AP may perform further analysis.In another example, an AP receives reports from other related APs andperforms correlation across reports to discover any correlation in DHCPissues. The report may include one or more of the following: informationabout the type of DHCP issue, identification of one or more clientsaffected by the DHCP issue, copies of packets analyzed to determine theDHCP issue, communication sent to identify the DHCP issue (e.g., packetsto confirm hypothesis), identification of an AP associated with the typeof event, a status of an AP, and any other information associated withthe identified DHCP issue. In some embodiments, by utilizing thereported information, the recipient may correlate the reportedinformation across various other reports from other APs to determine acorrelation result. For example, a DHCP problem affecting only one APmay be due to a network connection error specific to the particular APwhile the same network problem encountered by multiple different APssimultaneously may be due to a DHCP service error. In some embodiments,the report includes encrypted and/or compressed data. For example,compressed versions of DHCP control packets are included in the reportto reduce bandwidth required to transmit the report.

In some embodiments, once a DHCP issue has been detected and reported,the DHCP issue may be continually monitored, and a status update isprovided when applicable until the issue has been resolved and/or is nolonger applicable. For example, a list of clients affected by the DHCPissue is tracked and the status of the issue for each client isperiodically determined (e.g., send a status query communication to theDHCP service and/or a client and analyze the response, analyze new DHCPcontrol packets, etc.) and any changes in the status for each client arereported.

At 408, the detected DHCP issue is mitigated, if applicable. In someembodiments, the mitigation is based at least in part on analysis and/orcorrelation results associated with the report sent in 406. In someembodiments, the mitigation modifies a status, a configuration, data, afilter, a software component, a driver, and/or other component oroperation of an AP. In some embodiments, the mitigation is associatedwith preventing and/or resolving the DHCP issue.

For example, instructions and/or control messages/packets are sent to aDHCP server and/or a client to resolve the detected DHCP problem. Theactions to be performed to mitigate the DHCP problem may be determinedby a recipient of the reports and provided to an AP to be implemented.In some embodiments, the actions to be performed are determined by anAP. For example, an event type filter of the AP specifies actions to beperformed in the event a certain criteria/problem has been detected. Insome embodiments, mitigating the DHCP problem includes performing anaction on behalf of an affected client. For example, an AP generates andsends to a DHCP service/server a control packet to release an IP addresslease that appears to the DHCP service/server (e.g., spoofed packet) asif the control packet was generated by the affected client. This may benecessary due to certain versions of a DHCP server that cannot handleDHCP renewals. For example, when a client attempts to renew an IPaddress lease prior to its expiration, some DHCP services/servers rejectthe renewal and force the client to obtain a new IP address lease.However, the previous IP address lease has not been released when thenew IP address lease is requested and this may contribute to exhaustionof an IP address pool. When this is detected, an AP may send a controlmessage to the DHCP server to release the previous IP address lease tofree up the IP address of the previous IP address lease.

FIG. 5 is a flowchart illustrating an embodiment of a process foranalyzing DHCP issue event type reports. The process of FIG. 5 may beimplemented on analysis server 118 of FIG. 1. In some embodiments, theprocess of FIG. 5 is a specific example of the process of FIG. 3.

At 502, one or more reports indicating one or more DHCP issues arereceived. In some embodiments, one or more reports sent in 406 by one ormore APs are received. In some embodiments, the reports are receivedfrom a plurality of different APs and the reports from APs that areassociated (e.g., APs of same physical site, sent by the same event typefilter, etc.) are grouped together.

At 504, one or more reports are analyzed and correlated to determine ananalysis/correlation result. By processing analysis and/or correlationat a remote server, trends across APs may be correlated to determine ahigher level issue and/or better determine a cause and/or resolution ofthe DHCP issue. In some embodiments, control packets and/or other dataincluded in reports may be extracted from the report and separatelycorrelated/analyzed. In some embodiments, performing the correlation andanalysis includes analyzing the one or more reports to identify anaction to be performed based on the analysis result. For example, thereports are analyzed to identify a user indication, a warning, amessage, a status, and/or other information to be provided. In anotherexample, the reports are analyzed to identify an action to be performedto mitigate, prevent, and/or resolve the DHCP issue. In someembodiments, performing the correlation and analysis includesdetermining DHCP issue trends and correlating DHCP issues across clientsof different APs. For example, the number of clients and/or APs affectedby a specific DHCP problem may indicate the cause and/or resolution forthe DHCP issue event type (e.g., only one affected AP is likely aninternal issue with the AP while multiple affected APs are likely aproblem with a DHCP service). In some embodiments, theanalysis/correlation result is stored in storage (e.g., stored indatabase 124 of FIG. 1).

At 506, instructions associated with the analysis/correlation result areprovided. For example, the instruction is sent via a network to an APthat has encountered the DHCP issue. In some embodiments, step 506 isoptional. In some embodiments, the sent instruction is received at 408of FIG. 4 to mitigate the detected DHCP issue. In some embodiments, theinstruction is based at least in part on analysis and/or correlationresults performed in 504. For example, an instruction on how to resolvethe DHCP issue is provided. In some embodiments, the instructionspecifies a modification of a status, a configuration, data, a filter, asoftware component, a driver, and/or other component or operation of anAP or a client of the AP. In some embodiments, the instructionidentified an action to be performed by an AP on behalf of a client. Forexample, an AP generates and sends to a DHCP service/server a controlpacket to release an IP address lease that appears to the DHCPservice/server (e.g., spoofed packet) as if the control packet wasgenerated by the affected client. In some embodiments, the instructionis an instruction received by an AP in 408 of FIG. 4 to mitigate theDHCP issue.

At 508, the analysis/correlation result is provided. For example, a userand/or network administrator is provided an interface to view a summaryof DHCP issues encountered by clients/APs managed by the user. Forexample, the DHCP status summary is provided via a webpage interface. Insome embodiments, for each type of detected DHCP issue, anidentification of the DHCP issue, an identification of affectedclients/APs, a number of the affected clients/APs, a status of theaffected clients/APs, a length of time the affected clients/APs havebeen affected, possible resolutions for the detected DHCP issue, actionsattempted to resolve the detected DHCP issue, a performance of theaffected clients/APs, and/or any other related data/information isprovided to allow an administrator to track and manage the DHCP issue.

FIG. 6 is a flowchart illustrating an embodiment of a process forprocessing events to identify a client roaming error. The process ofFIG. 6 may be implemented on wireless access point 102 of FIG. 1. Invarious embodiments, the process of FIG. 6 is a specific example of theprocess of FIG. 2. In some cases, a client of an AP is unable toproperly roam between different APs to obtain the best wireless networkconnection. For example, a large physical site such as a hotel buildingincludes many deployed APs to cover various different physical locationzones of the hotel building. An ideal client efficiently roams andconnects to an AP that provides the best service. For example, once awireless signal strength is below a threshold value for at least athreshold amount of time and another valid AP with a stronger signalstrength has been detected, the client should connect to the new AP.However, certain clients, such as Apple Corporation iOS devices, attemptto maintain connection with a currently connected AP for as long aspossible despite poor network performance and despite having available adifferent AP with stronger signal strength. This may optimizeperformance for a typical home environment with a single AP but mayperform poorly in environments with multiple APs. In some embodiments,situations when a client should roam to a different AP are automaticallydetected by using an event type filter that monitors for network packetsto detect poor network performance for the client.

At 602, network communication packets associated with a poor wirelessnetwork connection are received. In some embodiments, receiving thepackets includes tapping into wireless radio drivers of an AP to obtainevent data (e.g., packets identifying retries, wireless signal strength,repeated packets, etc.). For example, when a wireless connection betweena client and an AP is poor, transmitted packets may become lost. Thismay lead to packets that are repeated (e.g., response was not receivedso packet is retried) and requested again. In some embodiments, areceived packet may indicate (e.g., in metadata) a signal strengthdetected by a client. In some embodiments, the received packet mayindicate a signal strength of a client connection detected by an AP. Thenetwork communication packet may include a control packet and a datapacket. In some embodiments, the received packet may indicate APs andassociated signal strength able to be detected by a client. In someembodiments, receiving the packets includes intercepting the packets.The network communication packets may include control packets, datapackets, message packets, or any other forms of communication packets.In some embodiments, receiving the packets includes specificallyselecting network communication packets that are associated with awireless connection performance. In some embodiments, the receivednetwork communication packets are stored. For example, the packets arestored in storage 110 of FIG. 1.

At 604, the received packets are analyzed to identify a poor wirelessconnection between a client and a wireless access point. For example,the wireless connection may be poor due to low wireless signal strength.In some embodiments, an event type filter (e.g., one filter of filters112 of FIG. 1) that is configured to identify poor wireless connectionsis executed. In some embodiments, analyzing the received packetsincludes identifying whether a communication error rate and/or adetected/reported wireless signal strength threshold is belowcorresponding threshold values. In the event the detected communicationerror rate and/or a detected/reported wireless signal strength is belowcorresponding threshold values, a poor wireless connection event type isdetected and identified. In some embodiments, information about a clientis probed and obtained. For example, a device type of the client, amodel/version of the wireless component of the client, an operatingsystem of the client, and/or other information about the client isobtained to enable determination of a solution. In some embodiments, oneor more packets probing the client are sent and the correspondingresponse(s) are analyzed.

At 606, any detected poor wireless connection event type is reported.The report may be sent to an analysis server (e.g., server 118) and/oranother AP for further analysis and/or archival/reporting. For example,a centralized server with more computing resources than an AP mayperform further analysis. In another example, an AP receives reportsfrom other related APs and performs correlation across reports todiscover a better AP for a client. The report may include one or more ofthe following: detected wireless devices of an AP and correspondingassociated wireless signal strengths, clients of an AP and correspondingassociated wireless signal strengths, communication error rates ofclients of an AP, identification of one or more clients associated withweak wireless connections, copies of packets analyzed to determine thepoor wireless connection, communication sent to identify the poorwireless connection, information about an AP, a status of an AP, aphysical location coordinate of a client, information about affectedclients, and any other information associated with the identified weakconnection(s). In some embodiments, by utilizing the reportedinformation, the recipient may correlate the reported information acrossvarious other reports from other APs to determine a correlation result.For example, a client that should roam to another AP is identified(e.g., client that is an iOS device and able to establish a betterconnection with another AP is identified). In some embodiments, thereport includes encrypted and/or compressed data. For example,compressed versions of packets are included in the report to reducebandwidth required to transmit the report.

In some embodiments, once a poor wireless connection has been detected,the connection status may be continually monitored, and a status updateis provided when applicable until the connection status is no longerweak and/or has been disconnected. For example, a list of clients withpoor wireless connections is tracked and the wireless connection statusfor each client is periodically determined and any changes in the statusfor each client is reported to an analysis server.

At 608, the poor wireless connection is terminated, if applicable. Forexample, an AP terminates a connection with a client to force the clientto connect to another AP. The client may attempt to reestablish awireless connection with the same AP associated with the weak wirelessconnection and the AP may continually refuse and/or terminate therepeated connection attempts for the client associated with the weakwireless connection for at least a configured amount of time and/or aconfigured number of attempts. The AP may allow the reconnection attemptin the event a signal strength of the client has improved by at least athreshold amount. The decision to terminate the connection to force aclient to connect to another AP may be determined by a server thatreceived the reports sent in 606. In some embodiments, the decision toterminate the connection is determined by an AP. For example, an eventtype filter of the AP specifies that a weak wireless signal is to beterminated in the event the client is able to connect to another validAP associated with a stronger wireless signal.

FIG. 7 is a flow chart illustrating an embodiment of a process foranalyzing reports of a poor wireless connection. The process of FIG. 7may be implemented on analysis server 118 of FIG. 1. In someembodiments, the process of FIG. 7 is a specific example of the processof FIG. 3.

At 702, one or more reports indicating one or more weak wirelessconnections are received. In some embodiments, one or more reports sentin 606 by one or more APs are received. In some embodiments, the reportsare received from a plurality of different APs and the reports fromrelated APs (e.g., APs of the same physical site) are grouped together.

At 704, one or more received reports are analyzed and correlated todetermine an analysis/correlation result. By processing analysis and/orcorrelation at a remote server, wireless connections across differentAPs may be tracked and managed at a central location to determine thebest AP for each client. In some embodiments, packets and/or other dataincluded in the reports may be extracted from the report and separatelycorrelated/analyzed. In some embodiments, performing the correlation andanalysis includes analyzing the one or more reports to identify anaction to be performed based on the analysis result. For example, thereports are analyzed to identify whether a client with a weak wirelesssignal strength connection to an AP should be disconnected to force theclient to connect to another AP.

In some embodiments, the type of client affected by the poor wirelessconnection is identified and in the event it is known that the client isof a type (e.g., iOS device type) known to not roam efficiently, it isdetermined whether a better AP for the client is available (e.g., wouldbe better served by another AP identified at least in part by analyzingsignal strength between the client and various APs as reported by theclient and/or the various APs). For example, if the signal strengthbetween the client and another AP is stronger by at least a thresholdamount, it is determined that a better AP is available for the client.In some embodiments, a status, a performance, a number of clients, andother information about APs are included in the reports and are utilizedto determine whether a better AP for the client is available. Forexample, although a client affected by a poor wireless connection canconnect to another AP associated with a higher signal strength, this APis not a better AP for the client because the AP is currentlyoverloaded. In some embodiments, the better AP is identified bydetermining/identifying a physical location of a client and identifyingthe best AP to provide wireless network access at the location of theclient. In some embodiments, the better AP is identified by analyzingsignal strength of a client detected by a plurality of APs. For example,each AP provides a report of wireless devices detected and associatedsignal strengths and the AP that reported the strongest signal strengthfor the client is selected. In some embodiments, analyzing andcorrelating the reports includes determining a best distribution ofwireless clients across APs of a site that maximizes one or more networkperformance factors (e.g., average bandwidth, peak bandwidth,reliability, etc.). In some embodiments, the analysis/correlation resultis stored in storage (e.g., stored in database 124 of FIG. 1).

At 706, one or more instructions associated with theanalysis/correlation of 704 are provided. For example, the instructionis sent via a network to an AP that is to disconnect a client. In someembodiments, step 706 is optional. In some embodiments, the sentinstruction is received at 608 of FIG. 6 to disconnect a clientassociated with a poor wireless signal. In some embodiments, theinstruction is based at least in part on analysis and/or correlationresults performed in 704. For example, a client associated with a weakwireless signal is to be disconnected if a better AP is available forthe client and fits with a determined distribution plan. In anotherexample, a client associated with a weak wireless signal is to bedisconnected if the client is of a specific type (e.g., iOS) and abetter AP is available for the client.

At 708, the analysis/correlation result is provided. For example, a userand/or network administrator is provided an interface to view a summaryof wireless network performance. For example, performance metrics forwireless connections are provided via a webpage interface. In someembodiments, for weak wireless connections, the identification ofaffected clients/APs, a number of the affected clients/APs, a status ofthe affected clients/APs, a length of time the affected clients/APs havebeen affected, possible resolutions for the detected type of event,instructions attempted to resolve the detected type of event, aperformance of the affected clients/APs, and/or any other relateddata/information is provided.

Although the foregoing embodiments have been described in some detailfor purposes of clarity of understanding, the invention is not limitedto the details provided. There are many alternative ways of implementingthe invention. The disclosed embodiments are illustrative and notrestrictive.

What is claimed is:
 1. A wireless access point system, comprising: a processor configured to tap event data and process the event data using a plurality of event filters, wherein each event filter of the plurality of event filters applies event criteria to detect one or more types of events, and tapping the event data includes intercepting the event data in the process of being routed, via the wireless access point system, between at least two different communication parties separate from the wireless access point system, and the event data is tapped within the wireless access point system using an analytic tap that observes network statistics and a performance tap that analyzes content included in the event data; a memory configured to store the tapped event data; and a communication interface configured to provide a report of a detected event type, wherein at least a portion of the report is correlated to analyze a performance of a wireless network.
 2. The system of claim 1, wherein the event data includes analytic data quantifying network performance and the performance of the wireless network includes a wireless network performance of a client of the wireless access point system.
 3. The system of claim 1, wherein at least the portion of the report is correlated with location information of a client of the wireless access point system to analyze the performance of the wireless network.
 4. The system of claim 1, wherein at least a portion of the report is correlated with at least a portion of another report of a different detected event type.
 5. The system of claim 1, wherein at least a portion of the report is correlated with at least external data detected external to a network of the wireless access point system.
 6. The system of claim 1, wherein at least a portion of the report indicating an error is correlated with at least a portion of another error report of the detected event type detected by another wireless access point system.
 7. The system of claim 1, wherein at least a portion of the report is correlated over time with another previous report of the wireless access point system.
 8. The system of claim 1, wherein tapping the event data includes obtaining a copy of the event data from a wireless radio driver of the wireless access point system.
 9. The system of claim 1, wherein tapping the event data includes obtaining a copy of the event data from an Ethernet driver of the wireless access point system.
 10. The system of claim 1, wherein the event data includes control network packets.
 11. The system of claim 1, wherein the event data includes network data packets.
 12. The system of claim 1, wherein the communication interface is further configured to send a status update for the detected event type.
 13. The system of claim 1, wherein the memory includes a ring buffer storing the tapped event data.
 14. The system of claim 1, wherein the processor is further configured to perform an action in response to detecting the detected event type.
 15. The system of claim 1, wherein the report is sent to a remote analysis server.
 16. The system of claim 1, wherein a result of the correlation is reported to a user.
 17. The system of claim 1, wherein the detected event type is associated with a DHCP service.
 18. The system of claim 1, wherein the report includes a copy of one or more network packets identified and indicating the detected event type.
 19. The system of claim 1, wherein the detected event type indicates an iOS client that does not roam to another wireless access point system due to an implementation of an iOS operating system.
 20. The system of claim 1, wherein the communication interface is further configured to receive a result of the correlation and the processor is further configured to implement an instruction of the result.
 21. The system of claim 20, wherein implementing the instruction includes terminating a wireless connection to force a client of the wireless connection to roam to another wireless access point system.
 22. The system of claim 20, wherein the implementing the instruction includes spoofing a request to release an IP address lease as if it was originated by a client and sending the request to a DHCP server.
 23. A method, comprising: tapping event data, wherein tapping the event data includes intercepting the event data in the process of being routed, via the wireless access point system, between at least two different communication parties separate from the wireless access point system, and the event data is tapped within the wireless access point system using an analytic tap that observes network statistics and a performance tap that analyzes content included in the event data; storing the event data; using a processor to process the event data using a plurality of event filters, wherein each event filter of the plurality of event filters applies event criteria to detect one or more types of events; and providing a report of a detected event type, wherein at least a portion of the report is correlated to analyze a performance of a wireless network.
 24. The method of claim 23, wherein the event data includes analytic data quantifying network performance and the performance of the wireless network includes a wireless network performance of a client of the wireless access point system.
 25. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for: tapping event data, wherein tapping the event data includes intercepting the event data in the process of being routed, via the wireless access point system, between at least two different communication parties separate from the wireless access point system, and the event data is tapped within the wireless access point system using an analytic tap that observes network statistics and a performance tap that analyzes content included in the event data; storing the event data; processing the event data using a plurality of event filters, wherein each event filter of the plurality of event filters applies event criteria to detect one or more types of events; and providing a report of a detected event type, wherein at least a portion of the report is correlated to analyze a performance of a wireless network. 